Openstack
CVE-2026-28370
CRITICAL
GHSA-8xwf-cr4r-856r
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to Vitrage API
-
ExploitCraft malicious query payload
-
ExecutionTrigger code execution in _create_query_function
-
ImpactExecute arbitrary code as Vitrage service user
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Eval input sanitization
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | High-privilege user account with access to Vitrage API. Vitrage service must be exposed and accepting API requests. Vulnerable versions: before 12.0.1, 13.0.0, 14.0.0, 15.0.0. |
| Impact | CVSS 9.1, PoC available. Vitrage is the Root Cause Analysis engine in OpenStack — compromise provides access to topology and alarm data across the cloud. |
| Exploit ScenarioDerived | Authenticated cloud user crafts malicious Vitrage query containing Python code, which executes on the Vitrage service with its privileges, potentially accessing other OpenStack services. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
Code injection in OpenStack Vitrage query parser allows authenticated users to execute arbitrary Python code through crafted queries. Affects versions before 12.0.1, 13.0.0, 14.0.0, and 15.0.0. PoC available.
Earlier versions of this analysis (1)
Code injection via query parser in OpenStack Vitrage RCA service.
RemediationAI
Update Vitrage to patched versions (12.0.1+, 13.0.1+, 14.0.1+, 15.0.1+). Restrict Vitrage API access to trusted users.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in pypi
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-95 in Vitrage's query parser. Authenticated users with Vitrage API access can inject Python code through query expressions that get evaluated server-side.
Know when Openstack gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
In the query parser in OpenStack Vitrage before 12.0.1, 13.0.0, 14.0.0, and 15.0.0, a user allowed to access the Vitrage API may trigger code execution on the Vitrage service host as the user the Vitrage service runs under. This may result in unauthorized access to the host and further compromise of the Vitrage service. All deployments exposing the Vitrage API are affected. This occurs in _create_query_function in vitrage/graph/query.py.
Executive ViewAI
A critical vulnerability in OpenStack Vitrage allows authenticated users to execute arbitrary code on the Vitrage service host, potentially compromising cloud infrastructure monitoring and control systems. Organizations running affected Vitrage versions face immediate risk of unauthorized access and lateral movement within their OpenStack environments.
Network segmentation isolating Vitrage API endpoints; restrict API authentication to service accounts with minimal privileges; implement WAF rules to filter malicious query syntax in the query parser; disable Vitrage query parser API if not operationally required; increase monitoring/alerting on Vitrage service process execution and file modifications; implement strict input validation at API gateway level.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Affected Products (CPE)CVE.org
Oracle MySQL through 5.5.52, 5.6.x through 5.6.33, and 5.7.x through 5.7.15; MariaDB before 5.5.51, 10.0.x before 10.0.2
Eval injection vulnerability in the create method in the Bookmarks controller in Foreman before 1.2.0-RC2 allows remote
The create method in app/controllers/users_controller.rb in Foreman before 1.2.0-RC2 allows remote authenticated users w
Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addres
The Floppy Disk Controller (FDC) in QEMU, as used in Xen 4.5.x and earlier and KVM, allows local guest users to cause a
Memory Corruption was discovered in the cmsgpack library in the Lua subsystem in Redis before 3.2.12, 4.x before 4.0.10,
The IPTables firewall in OpenStack Neutron before 7.0.4 and 8.0.0 through 8.1.0 allows remote attackers to bypass an int
An issue in OpenStack magnum yoga-eom version allows a remote attacker to execute arbitrary code via the cert_manager.py
An Integer Overflow issue was discovered in the struct library in the Lua subsystem in Redis before 3.2.12, 4.x before 4
glibc contains a vulnerability that allows specially crafted LD_LIBRARY_PATH values to manipulate the heap/stack, causin
Buffer overflow in the pcnet_receive function in hw/net/pcnet.c in QEMU, when a guest NIC has a larger MTU, allows remot
OpenStack Neutron before 16.4.1, 17.x before 17.1.3, and 18.0.0 allows hardware address impersonation when the linuxbrid
Exploit-DB